Carbon Black Cloud: Live Response execfg command fails with "Remote error 0x80070002"

[#1]

Environment

• Carbon Black Cloud Console: All Versions
  • Enterprise EDR
• Carbon Black Cloud Sensor: 3.6.0.2072
• Microsoft Windows: All Supported Versions
• Third party AV service

Symptoms

Cannot run repcli commands locally. Message mentions sysfer.dll

Cause

AV service is blocking sensor actions

Resolution

• Ensure AV exclusions are added for the sensor on the third party AV service: Carbon Black Cloud: Recommended Third-Party Anti-virus Exclusions
• If AV exlcusions are in place and issue persists, open a case with support and provide:
  • Procmon capture from the endpoint while reproducing the issue
  • Sensor logs after issue was reproduced